CVE-2026-102638: Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What user action is required for exploitation?
A user must import a malicious electronic library (.lbr) file and then have its description displayed in the Library Manager. The attack relies on a crafted HTML payload in that description.
Who is exposed to this issue?
Autodesk Fusion desktop users who import electronic library files from untrusted or insufficiently vetted sources are exposed. The vulnerability executes in the context of the current Fusion process and may allow local file reading or arbitrary code execution.
What can be done while a fix is not available?
Do not import .lbr files from untrusted sources, and validate the provenance and contents of library files before importing them. Avoid opening Library Manager descriptions for libraries whose origin cannot be verified.